p PatchFirst

CVE-2022-21715

CVE-2022-21715 · Cross-site Scripting Vulnerability in CodeIgniter4

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.

CVSS 5.4 · Media · EPSS 1,0% · Corrección disponible

Publicación
Actualización

Pila tecnológica: php

Productos y versiones afectados

  • codeigniter4

    Versiones
    • < 4.1.8: Afectada

    Sin corrección publicada

  • codeigniter4/framework Packagist

    Versiones
    • 4.0.0
    • 4.0.0-rc.4
    • v4.0.0-alpha.3
    • v4.0.0-alpha.4
    • v4.0.0-alpha.5
    • v4.0.0-beta.1
    • v4.0.0-beta.2
    • v4.0.0-beta.3
    • v4.0.0-beta.4
    • v4.0.0-rc.1
    • v4.0.0-rc.2
    • v4.0.0-rc.2.1
    • v4.0.0-rc.3
    • v4.0.1
    • v4.0.2
    • v4.0.3
    • v4.0.4
    • v4.0.5
    • v4.1.0
    • v4.1.1
    • v4.1.2
    • v4.1.3
    • v4.1.4
    • v4.1.5
    • v4.1.6
    • v4.1.7
    Intervalos de versiones afectados
    • ECOSYSTEM: < 4.1.8

    Actualiza a 4.1.8

Fuentes originales

Comprueba tu servidor →